Merge pull request 'docs(inventory): ntp_cluster has two members, edge-1 and edge-2' (#1582 ) from docs/ntp-cluster-edge2 into main

Reviewed-on: #1582
Merge pull request 'docs(hairpin): list k8s VLANs 46/47/48 as deliberately absent' (#1581 ) from docs/hairpin-absent-vlans into main
2026-11-06 13:51:17 +00:00 · 2026-11-06 13:50:58 +00:00 · 2026-11-06 14:46:43 +01:00 · 2026-11-06 14:38:37 +01:00 · 2026-11-06 13:01:23 +00:00
2 changed files with 13 additions and 21 deletions
@@ -49,20 +49,11 @@ edge-1.iot.renner.uno
 zwave_gateway
 heating_can

-# NTP servers. edge-1 was added here so the role would survive the PVE hosts
-# being retired for bare-metal Talos, which cannot run chrony or keepalived
-# itself. That retirement has now happened, so edge-1 is the ONLY member.
-#
-# THIS IS NO LONGER HIGHLY AVAILABLE. The group was jupiter (MASTER, prio 100),
-# saturn (90), neptune (80) and edge-1 (BACKUP, 70); the first three are gone.
-# A single VRRP member takes the address regardless of its configured state, so
-# the service address is still served, but by one thin client with
-# no failover behind it. install-ntp-ha.yml still carries the four-host
-# ntp_servers priority map, which now describes hosts that do not exist.
-#
-# Restoring redundancy needs a second chrony host that is not a Talos node.
-# See plays/install-ntp-ha.yml for why keepalived is scoped more narrowly than
-# chrony within this group.
+# NTP servers: every edge host (edge-1 BACKUP prio 70, edge-2 BACKUP prio 60;
+# see the ntp_servers map in plays/install-ntp-ha.yml). Talos nodes cannot run
+# chrony or keepalived. The jupiter/saturn/neptune entries in that map
+# describe retired PVE hosts. See plays/install-ntp-ha.yml for why keepalived
+# is scoped more narrowly than chrony within this group.
 [ntp_cluster:children]
 edge_host

@@ -68,13 +68,14 @@ locals {
  # idx is a static per-network slot for rule_index derivation — never
  # reuse a freed idx for a new network.
  #
-  # Deliberately absent: (40) Server idx=4, (42) Ingress idx=5, and
-  # (49) k8s Ceph idx=6. The cluster nodes have interfaces on those VLANs,
-  # so a DNATed flow's reply would go directly over the shared L2 and
-  # bypass the UDM's conntrack (asymmetric, connection drops) — and
-  # clients there are the nodes themselves, whose DNS chain (CoreDNS ->
-  # k8s_gateway) already resolves the public names in-cluster. Their idx
-  # slots stay reserved.
+  # Deliberately absent: (40) Server idx=4, (49) k8s Ceph idx=6,
+  # (46) k8s Node, (47) k8s Ingress and (48) k8s Pod. The cluster nodes
+  # have interfaces on those VLANs (mgmt0, node0, ingress0, pod0), so a
+  # DNATed flow's reply would go directly over the shared L2 and bypass
+  # the UDM's conntrack (asymmetric, connection drops) — and clients there
+  # are the nodes themselves, whose DNS chain (CoreDNS -> k8s_gateway)
+  # already resolves the public names in-cluster. idx=5 stays reserved
+  # (its network, (42) Ingress, no longer exists).
  hairpin_networks = {
    "Default"              = { id = "5d4fba77ce63ee614841d53d", idx = 0 }
    "(10) Management"      = { id = "600334abf9ee0c059da6be8f", idx = 1 }
Author	SHA1	Message	Date
k.renner	2beb9a4e14	Merge pull request 'docs(inventory): ntp_cluster has two members, edge-1 and edge-2' (#1582 ) from docs/ntp-cluster-edge2 into main Reviewed-on: #1582	2026-11-06 13:51:17 +00:00
k.renner	767b3cdac4	Merge pull request 'docs(hairpin): list k8s VLANs 46/47/48 as deliberately absent' (#1581 ) from docs/hairpin-absent-vlans into main ci/woodpecker/push/deploy-infrastructure Pipeline was successful Details Reviewed-on: #1581	2026-11-06 13:50:58 +00:00
claude-botandClaude Opus 5.5	ccb69bb109	docs(inventory): ntp_cluster has two members, edge-1 and edge-2 ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details edge-2 is in [edge_host] and in the ntp_servers map of install-ntp-ha.yml (BACKUP, prio 60) and answers NTP (stratum 2) on 10.2.30.184. The comment still called edge-1 the only member. Refs S28-14 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-06 14:46:43 +01:00
claude-botandClaude Opus 5.5	69f7075c7c	docs(hairpin): list k8s VLANs 46/47/48 as deliberately absent ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details The nodes hold addresses on 46 (node0), 47 (ingress0) and 48 (pod0), the same asymmetric-reply reason that excludes 40 and 49. (42) Ingress no longer exists; its idx slot stays reserved. Refs S28-13 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-06 14:38:37 +01:00
k.renner	1b06a922a9	Merge pull request 'fix(pacman-cache): empty the pacman package cache before the edge image pulls' (#1580 ) from fix/common-pacman-cache into main Reviewed-on: #1580	2026-11-06 13:01:23 +00:00